Nice article, it was a fund reading it. Albeit I don't think this kind of attack is restricted to just JavaScript.